database-lateral-pivot

Database Lateral Movement Methodology

Databases are natural pivot points in an intranet—they usually have looser network access policies than application servers (they need to connect to multiple services), and PostgreSQL's dblink, MSSQL's Linked Server, and MySQL's FEDERATED engine all provide native cross-host query capabilities. When application-layer network isolation is strict, lateral movement through databases is often the only path.

⛔ In-Depth Reference (Required Reading)

• Complete commands and scenarios for dblink connections, Linked Server exploitation, and SSRF probing → references/dblink-lateral.md

---

Phase 1: Assess Lateral Movement Conditions

Collect information in the current database to determine the possibility of lateral movement:

-- PostgreSQL: 检查可用扩展
SELECT * FROM pg_available_extensions WHERE name IN ('dblink','postgres_fdw');

-- PostgreSQL: existing foreign connection configurations SELECT * FROM pg_foreign_server; SELECT * FROM pg_user_mapping;

-- MSSQL: check Linked Servers EXEC sp_linkedservers; SELECT * FROM sys.servers WHERE is_linked = 1;

-- MySQL: check the FEDERATED engine SHOW ENGINES;

**横向条件清单**：
- 当前是 superuser/sa/root 吗？（非特权用户通常无法创建 dblink）
- 数据库配置中有没有其他主机的连接信息？
- 环境变量/配置文件中有没有其他数据库的凭据？

## Phase 2: 内网信息收集（通过数据库）

数据库本身就是信息金矿：

```sql
-- 搜索连接字符串
SELECT * FROM pg_settings WHERE name LIKE '%connection%';

-- 搜索包含密码的表/列
SELECT table_name, column_name FROM information_schema.columns
WHERE column_name LIKE '%pass%' OR column_name LIKE '%secret%' OR column_name LIKE '%token%';

-- 查找其他数据库主机（配置表中常有）
SELECT * FROM config WHERE key LIKE '%host%' OR key LIKE '%db%' OR value LIKE '%.%.%.%';

Phase 3: Lateral Attack Decision Tree

已控制一个数据库？
├─ PostgreSQL → 
│   ├─ dblink（最灵活）→ 连接任意 PostgreSQL/支持的数据库
│   ├─ postgres_fdw（外部数据封装器）→ 透明跨库查询
│   └─ COPY TO PROGRAM + curl → SSRF 探测内网
├─ MSSQL →
│   ├─ Linked Server → 连接其他 MSSQL/任意 OLE DB 数据源
│   ├─ OPENROWSET → 即席跨库查询
│   └─ xp_cmdshell + curl → 内网探测
├─ MySQL →
│   ├─ FEDERATED 引擎 → 跨 MySQL 实例查询
│   └─ LOAD DATA LOCAL → 读取本地文件
└─ 通用 → 
    ├─ 通过命令执行进行端口扫描/服务发现
    └─ 利用数据库中存储的凭据连接其他服务

→ Complete commands for lateral movement in each database → references/dblink-lateral.md

Phase 4: Post-Lateral Exploitation

After successfully connecting to a new database:

1. Extract data — user tables, configuration tables, flag
2. Obtain RCE — COPY FROM PROGRAM / xp_cmdshell / UDF
3. Continue lateral movement — the new database may connect to more intranet resources
4. Persistence — create backdoor accounts, triggers

Notes

• Traffic generated by dblink/Linked Server queries comes from thedatabase server IP, not your attack machine IP
• Exploiting this characteristic can bypass IP-based network ACLs
• Communication between databases is usually plaintext; mind credential security
• Large numbers of cross-database queries generate logs; be mindful of operational restraint